Single Actor Bypassed Open VSX Security with “Disposable” Tools

Security researcher Yeeth Security detected a sophisticated campaign on the Open VSX marketplace (Apr 27–28, 2026) in which a single threat actor published 16 malicious extensions that appeared unrelated but used string-fragment reconstruction and regenerated bundles with disposable publisher identities to hide runtime payload URLs; analysis tied samples to a common payload host (github.com/francesca898/dqwffqw) and the malicious infrastructure remained active at time of reporting.